bhetherman/open-webui
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refac

Browse Source
This commit is contained in:
Timothy Jaeryang Baek committed 2026-08-17 00:42:16 -07:00
1 parent c0d09a5de9
commit d799e81edb
2 files changed
+111 -74
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/open_webui/routers/auths.py
+17
View File
@@ -1705,4 +1705,21 @@ async def token_exchange(
detail='User not found. Please sign in via the web interface first.', detail='User not found. Please sign in via the web interface first.',
) )
user = await oauth_manager.update_user_from_oauth(
request=request,
user=user,
user_data=user_data,
provider=provider,
token=token_data,
db=db,
)
if await Config.get('oauth.enable_group_mapping'):
await oauth_manager.update_user_groups(
request=request,
user=user,
user_data=user_data,
default_permissions=await Config.get('user.permissions'),
db=db,
)
return await create_session_response(request, user, db, source='oauth') return await create_session_response(request, user, db, source='oauth')
backend/open_webui/utils/oauth.py
+94 -74
View File
@@ -1519,8 +1519,8 @@ class OAuthManager:
oauth_allowed_roles = auth_config.OAUTH_ALLOWED_ROLES oauth_allowed_roles = auth_config.OAUTH_ALLOWED_ROLES
oauth_admin_roles = auth_config.OAUTH_ADMIN_ROLES oauth_admin_roles = auth_config.OAUTH_ADMIN_ROLES
oauth_roles = [] oauth_roles = []
# Default/fallback role if no matching roles are found # Keep existing users at their current role unless the provider sent roles.
role = auth_config.DEFAULT_USER_ROLE role = user.role if user else auth_config.DEFAULT_USER_ROLE
# Next block extracts the roles from the user data, accepting nested claims of any depth # Next block extracts the roles from the user data, accepting nested claims of any depth
if oauth_claim and oauth_allowed_roles and oauth_admin_roles: if oauth_claim and oauth_allowed_roles and oauth_admin_roles:
@@ -1585,6 +1585,90 @@ class OAuthManager:
return role return role
async def update_user_from_oauth(
self,
request,
user,
user_data,
provider,
token: dict | None = None,
*,
db=None,
):
auth_config = await get_oauth_runtime_config()
determined_role = await self.get_user_role(user, user_data)
if user.role != determined_role:
updated_user = await Users.update_user_role_by_id(user.id, determined_role, db=db)
user = updated_user or user
user.role = determined_role
await publish_event(
request,
EVENTS.USER_ROLE_UPDATED,
actor=user,
subject_id=user.id,
source='oauth',
data={'role': determined_role, 'provider': provider},
)
updated_fields = []
if auth_config.OAUTH_UPDATE_NAME_ON_LOGIN:
username_claim = auth_config.OAUTH_USERNAME_CLAIM
if username_claim:
new_name = user_data.get(username_claim)
if new_name and new_name != user.name:
updated_user = await Users.update_user_by_id(user.id, {'name': new_name}, db=db)
if updated_user:
user = updated_user
updated_fields.append('name')
log.debug('Updated name for user %s', user.email)
if auth_config.OAUTH_UPDATE_EMAIL_ON_LOGIN:
email_claim = auth_config.OAUTH_EMAIL_CLAIM
if email_claim:
new_email = user_data.get(email_claim)
if new_email and new_email.lower() != user.email.lower():
existing_user = await Users.get_user_by_email(new_email, db=db)
if existing_user:
log.error(
f'Cannot update email to {new_email} for user {user.id} because it is already taken.'
)
elif await Auths.update_email_by_id(user.id, new_email.lower(), db=db):
user = await Users.get_user_by_id(user.id, db=db) or user
updated_fields.append('email')
log.debug('Updated email for user %s', user.id)
if auth_config.OAUTH_UPDATE_PICTURE_ON_LOGIN:
picture_claim = auth_config.OAUTH_PICTURE_CLAIM
if picture_claim:
new_picture_url = user_data.get(
picture_claim,
OAUTH_PROVIDERS[provider].get('picture_url', ''),
)
access_token = token.get('access_token') if token else None
processed_picture_url = await self._process_picture_url(new_picture_url, access_token)
if processed_picture_url != user.profile_image_url:
updated_user = await Users.update_user_profile_image_url_by_id(
user.id, processed_picture_url, db=db
)
if updated_user:
user = updated_user
updated_fields.append('profile_image_url')
log.debug('Updated profile picture for user %s', user.email)
if updated_fields:
await publish_event(
request,
EVENTS.USER_UPDATED,
actor=user,
subject_id=user.id,
source='oauth',
data={'updated_fields': updated_fields, 'provider': provider},
)
return user
async def update_user_groups(self, request, user, user_data, default_permissions, db=None): async def update_user_groups(self, request, user, user_data, default_permissions, db=None):
auth_config = await get_oauth_runtime_config() auth_config = await get_oauth_runtime_config()
log.debug('Running OAUTH Group management') log.debug('Running OAUTH Group management')
@@ -1963,78 +2047,14 @@ class OAuthManager:
await Users.update_user_oauth_by_id(user.id, provider, sub, db=db) await Users.update_user_oauth_by_id(user.id, provider, sub, db=db)
if user: if user:
determined_role = await self.get_user_role(user, user_data) user = await self.update_user_from_oauth(
if user.role != determined_role: request=request,
updated_user = await Users.update_user_role_by_id(user.id, determined_role, db=db) user=user,
# Update the user object in memory as well, user_data=user_data,
# to avoid problems with the ENABLE_OAUTH_GROUP_MANAGEMENT check below provider=provider,
user.role = determined_role token=token,
await publish_event( db=db,
request, )
EVENTS.USER_ROLE_UPDATED,
actor=updated_user or user,
subject_id=user.id,
source='oauth',
data={'role': determined_role, 'provider': provider},
)
updated_fields = []
if auth_config.OAUTH_UPDATE_NAME_ON_LOGIN:
username_claim = auth_config.OAUTH_USERNAME_CLAIM
if username_claim:
new_name = user_data.get(username_claim)
if new_name and new_name != user.name:
updated_user = await Users.update_user_by_id(user.id, {'name': new_name}, db=db)
if updated_user:
user = updated_user
updated_fields.append('name')
log.debug('Updated name for user %s', user.email)
if auth_config.OAUTH_UPDATE_EMAIL_ON_LOGIN:
email_claim = auth_config.OAUTH_EMAIL_CLAIM
if email_claim:
new_email = user_data.get(email_claim)
if new_email and new_email.lower() != user.email.lower():
existing_user = await Users.get_user_by_email(new_email, db=db)
if existing_user:
log.error(
f'Cannot update email to {new_email} for user {user.id} because it is already taken.'
)
elif await Auths.update_email_by_id(user.id, new_email.lower(), db=db):
user = await Users.get_user_by_id(user.id, db=db) or user
updated_fields.append('email')
log.debug('Updated email for user %s', user.id)
# Update profile picture if enabled and different from current
if auth_config.OAUTH_UPDATE_PICTURE_ON_LOGIN:
picture_claim = auth_config.OAUTH_PICTURE_CLAIM
if picture_claim:
new_picture_url = user_data.get(
picture_claim,
OAUTH_PROVIDERS[provider].get('picture_url', ''),
)
processed_picture_url = await self._process_picture_url(
new_picture_url, token.get('access_token')
)
if processed_picture_url != user.profile_image_url:
updated_user = await Users.update_user_profile_image_url_by_id(
user.id, processed_picture_url, db=db
)
if updated_user:
user = updated_user
updated_fields.append('profile_image_url')
log.debug('Updated profile picture for user %s', user.email)
if updated_fields:
await publish_event(
request,
EVENTS.USER_UPDATED,
actor=user,
subject_id=user.id,
source='oauth',
data={'updated_fields': updated_fields, 'provider': provider},
)
else: else:
# If the user does not exist, check if signups are enabled # If the user does not exist, check if signups are enabled
if auth_config.ENABLE_OAUTH_SIGNUP: if auth_config.ENABLE_OAUTH_SIGNUP: